lists.openwall.net   lists  /  announce  owl-users  owl-dev  john-users  john-dev  passwdqc-users  yescrypt  popa3d-users  /  oss-security  kernel-hardening  musl  sabotage  tlsify  passwords  /  crypt-dev  xvendor  /  Bugtraq  Full-Disclosure  linux-kernel  linux-netdev  linux-ext4  linux-hardening  linux-cve-announce  PHC 
Open Source and information security mailing list archives
 
Hash Suite: Windows password security audit tool. GUI, reports in PDF.
[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]
Message-Id: <200702152046.35638.hugo@infohacking.com>
Date: Thu, 15 Feb 2007 20:46:35 +0100
From: Hugo Vázquez Caramés <hugo@...ohacking.com>
To: Amit Klein <aksecurity@...il.com>
Cc: bugtraq@...urityfocus.com
Subject: Re: Apache Multiple Injection Vulnerabilities

Yes, that's true, control characters are not in violation of the stated 
charset "iso-8859-1". Thank you for notice me this. Unfortunately I mispelled 
"iso-8859-1" as "iso 8859-1" wich is not the same. I'm sorry for this. I'll 
correct this right now.

Sincerely,

> Just a quick note: what you demonstrated is that "control characters"
> are returned in a response whose charset is "iso-8859-1". But your text
> later states that "ISO 8859-1 encodes ...". Notice the difference:
> "iso-8859-1" vs. "iso 8859-1" - hyphen vs. space. These are different
> character sets - iso-8859-1 is a superset of iso 8859-1, adding all
> those control characters and whatnot. From RFC-1345:
>
> &charset ISO_8859-1:1987
>   &rem source: ECMA registry
>   &alias iso-ir-100
>   &g1esc x2d41 &g2esc x2e41 &g3esc x2f41
>   &alias ISO_8859-1
>   &alias ISO-8859-1
>   &alias latin1
>   &alias l1
>   &alias IBM819
>   &alias CP819
>   &code 0
>   NU SH SX EX ET EQ AK BL BS HT LF VT FF CR SO SI
>   DL D1 D2 D3 D4 NK SY EB CN EM SB EC FS GS RS US
>   SP ! " Nb DO % & ' ( ) * + , - . / 0 1 2 3 4 5 6 7 8 9 : ; < = > ?control 
characters are not in violation of the stated charset
>   At A B C D E F G H I J K L M N O P Q R S T U V W X Y Z <( // )> '> _
>   '! a b c d e f g h i j k l m n o p q r s t u v w x y z (! !! !) '? DT
>   PA HO BH NH IN NL SA ES HS HJ VS PD PU RI S2 S3
>   DC P1 P2 TS CC MW SG EG SS GC SC CI ST OC PM AC
>   NS !I Ct Pd Cu Ye BB SE ': Co -a << NO -- Rg '-
>   DG +- 2S 3S '' My PI .M ', 1S -o >> 14 12 34 ?I
>   A! A' A> A? A: AA AE C, E! E' E> E: I! I' I> I:
>   D- N? O! O' O> O? O: *X O/ U! U' U> U: Y' TH ss
>   a! a' a> a? a: aa ae c, e! e' e> e: i! i' i> i:
>   d- n? o! o' o> o? o: -: o/ u! u' u> u: y' th y:
>
> So those control characters are not in violation of the stated charset.
>
> Thanks,
> -Amit

-- 
$>cd /pub
$>more beer

"I spent a lot of money on booze, birds and fast cars.
The rest I just squandered"
George Best

"¡Triste época la nuestra! Es más fácil desintegrar un átomo que un
prejuicio."
Albert Einstein

"Que dos y dos sean necesariamente cuatro, es una opinión que muchos
compartimos. Pero si alguien sinceramente piensa otra cosa, que lo diga. Aquí
no nos asombramos de nada."
Antonio Machado

"La política es el arte de buscar problemas, encontrarlos, hacer un
diagnóstico falso y aplicar después los remedios equivocados."
Groucho Marx

"No permitais que vuestros estudios interfieran en vuestra
educación..."


Powered by blists - more mailing lists

Powered by Openwall GNU/*/Linux Powered by OpenVZ